389-users June 2006

389-users@lists.fedoraproject.org

51 participants
61 discussions

[Fedora-directory-users] Download package for various FC/RHEL versions?
by Bryan Smith 19 Jun '06

19 Jun '06

On the download pages, I noted that the same package should be used for both FC2 and RHEL3. Is this correct? It was always my assumption that RHL8, RHL9 and FC1 used the same packages as RHEL3, while FC2 and FC3 were the same as RHEL4. As such, should it not be that the FC3/RHEL4 version is also what should be downloaded for FC2? And then the RHEL3 would also be for FC1, not FC2? About the only place where FC2 differs from FC3/RHEL4 seems to be GCC (3.3 for the former instead of 3.4 like the latter two). FC1 actually ships the same version as FC2, and not the same as FC1/RHEL3 (3.3 for the former instead of 3.2 like the latter two). So I'm just curious if the download recommendation is correct for FC2? -- Bryan P.S. I've been tracking Kernel, C and GLibC (among other, core ABI packages) on Red Hat releases over the years. I recently posted a simplified history table through FC5 on my blog here: http://thebs413.blogspot.com/2006/05/fedora-red-hat-abi-compatibility.html -- Bryan J. Smith Professional, technical annoyance mailto:b.j.smith@ieee.org http://thebs413.blogspot.com ---------------------------------------------------------- The existence of Linux has far more to do with the breakup of AT&T's monopoly than anything Microsoft has ever done.

2 1

[Fedora-directory-users] Migrate to FDS
by David A. Hopkins 19 Jun '06

19 Jun '06

Sorry if this is obvious, but I have an existing LDAP directory based on Openldap and the smbldap-tools. Can I simply migrate the existing system to FDS? It is running on an x86_64 architecture. I suspect I could install FDS on a second system, sync with the existing system, then decommission the existing, install FDS, sync, and be good to go? But ... I am not sure. Thanks, Dave Hopkins

1 0

[Fedora-directory-users] phpldapadmin acl configuration
by Mikael Kermorgant 18 Jun '06

18 Jun '06

Hello, I've tried to setup phpldapadmin but it fails after login with this error : --- Our attempts to find your SCHEMA for "attributetypes" have FAILED. --- I've read that Fedora DS works with phpldapadmin and that this error can be due to wrong acl : http://wiki.pldapadmin.com/tiki-view_faq.php?faqId=1#q11 I've created a special user phpldapadmin but don't know what rights to give to him as I haven't found cn=subschema Would someone have an idea ? Regards, -- Mikael Kermorgant

2 4

[Fedora-directory-users] Password synchronization error
by Jeff Gamsby 17 Jun '06

17 Jun '06

Has anyone ever come across this error: [15/Jun/2006:21:54:25 -0700] NSMMReplicationPlugin - agmt="cn=AD" (ad:636): Received error [0000216C: AtrErr: DSID-031D0AC0, #1: 0:0000216C: DSID-031D0AC0, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 9005a (unicodePwd) ] when attempting to modify entry [<GUID=e873f710d5b9394db14c701cf5f11821>]: Please correct the attribute specified in the error message. Refer to the Windows Active Directory docs for more information. [15/Jun/2006:21:54:25 -0700] NSMMReplicationPlugin - agmt="cn=AD" (ad:636): windows_replay_update: update password returned 1 [15/Jun/2006:21:54:25 -0700] NSMMReplicationPlugin - agmt="cn=AD" (ad:636): Consumer failed to replay change (uniqueid 3783a101-1dd211b2-802fd24c-a4ed0000, CSN 4492399a000000010000): Constraint violation. Skipping. I used ldapmodify to change the password. This is the ldif file that I used: dn: uid=user,ou=people,dc=server,dc=example,dc=com changetype: modify replace: userpassword userpassword:: e2NyeXB0fSQxJHREb0RZV3JxJFE5UDVmMmVnSzc4NHAvVXVKVldnTS4= It successfully changes the password in FDS, but not in AD Thanks, Jeff

2 3

[Fedora-directory-users] Password synchronization error
by Jeff Gamsby 16 Jun '06

16 Jun '06

Has anyone ever come across this error: [15/Jun/2006:21:54:25 -0700] NSMMReplicationPlugin - agmt="cn=AD" (ad:636): Received error [0000216C: AtrErr: DSID-031D0AC0, #1: 0:0000216C: DSID-031D0AC0, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 9005a (unicodePwd) ] when attempting to modify entry [<GUID=e873f710d5b9394db14c701cf5f11821>]: Please correct the attribute specified in the error message. Refer to the Windows Active Directory docs for more information. [15/Jun/2006:21:54:25 -0700] NSMMReplicationPlugin - agmt="cn=AD" (ad:636): windows_replay_update: update password returned 1 [15/Jun/2006:21:54:25 -0700] NSMMReplicationPlugin - agmt="cn=AD" (ad:636): Consumer failed to replay change (uniqueid 3783a101-1dd211b2-802fd24c-a4ed0000, CSN 4492399a000000010000): Constraint violation. Skipping. I used ldapmodify to change the password. This is the ldif file that I used: dn: uid=user,ou=people,dc=server,dc=example,dc=com changetype: modify replace: userpassword userpassword:: (cut and paste from userpassword attribute after ldapsearch) It successfully changes the password in FDS, but not in AD Thanks, Jeff

1 0

[Fedora-directory-users] Fedora DS installation on Ubuntu Dapper Drake
by Olivier Brugman 16 Jun '06

16 Jun '06

Hi all, Thank you for the FDS software! This morning I installed the Fedora Directory Server (FDS) on Ubuntu Dapper Drake (6.06 LTS). This procedure seems to work for me in order to get FDS running on the Dapper platform: The procedure is almost equal to the existing howto for Ubuntu Breezy Badger and Debian GNU/Linux Sarge which is available at http://directory.fedora.redhat.com/wiki/Howto:DebianUbuntu I'll just describe the parts that deviate. I installed the FDS on a clean minimal installation of Ubuntu Dapper Drake server-version (x86), which is available at http://www.ubuntu.com/download As Dapper uses libc6 version 2.3.6 I took the Fedora Core 4-rpm (version 1.0.2) as a base for conversion to '.deb'. You can download the rpm at http://directory.fedora.redhat.com/wiki/Download The necessary termcap-compat package does not seem to be available for 'Dapper', so I just used the 'Breezy' version of that package. termcap-compat depends on the 'libc5' and 'ldso' packages which aren't available for 'Dapper' eighter. You can get the Breezy-version of these packages at http://packages.ubuntu.com/ BTW, I used the Sun jdk 1.5.0_02. After the installation of the fedora-ds .deb-package I used the setuputil and an existing 'install.inf' file (see example hereunder) to do a silent install of the FDS. You can invoke the silent install like so: sudo /opt/fedora-ds/setup/setup -s -f /opt/install.inf Example install.inf: [General] FullMachineName= xenfds.intra.example.com SuiteSpotUserID= fds SuiteSpotGroup= fds ServerRoot= /opt/fedora-ds AdminDomain= intra.example.com ConfigDirectoryAdminID= admin ConfigDirectoryAdminPwd= yourpasswordhere ConfigDirectoryLdapURL= ldap://xenfds.intra.example.com:389/o=NetscapeRoot UserDirectoryAdminID= admin UserDirectoryAdminPwd= yourpasswordhere UserDirectoryLdapURL= ldap://xenfds.intra.example.com:389/dc=intra,dc=example,dc=com [slapd] SlapdConfigForMC= Yes SecurityOn= No UseExistingMC= No UseExistingUG= No ServerPort= 389 ServerIdentifier= xenfds Suffix= dc=intra, dc=example, dc=com RootDN= cn=Directory Manager AddSampleEntries= No InstallLdifFile= suggest AddOrgEntries= Yes DisableSchemaChecking= No RootDNPwd= hannibal [admin] SysUser= root Port= 7777 ServerIpAddress= ServerAdminID= admin ServerAdminPwd= yourpasswordhere ApacheDir= /usr/sbin ApacheRoot= /usr/lib/apache2 HTH, Olivier Brugman

2 6

[Fedora-directory-users] PassSync only working one way
by Jeff Gamsby 15 Jun '06

15 Jun '06

I thought that I had the PassSync working until I ran into this problem: Passwords are not synchronized from FDS to AD. When accounts are added to FDS, they do show up in AD ( Although sometimes the cn attribute gets base64 encoded ), but I cannot authenticate to AD. When I change passwords in the FDS side, they are not changed ( or not sent ) to AD. If I change passwords in AD, they are changed in the FDS. The logs show that something is happening (changed host names and dn's) [13/Jun/2006:15:03:41 -0700] NSMMReplicationPlugin - agmt="cn=AD" (ad:636): No linger to cancel on the connection [13/Jun/2006:15:03:41 -0700] NSMMReplicationPlugin - windows_acquire_replica returned success (101) [13/Jun/2006:15:03:41 -0700] NSMMReplicationPlugin - agmt="cn=AD" (ad:636): State: ready_to_acquire_replica -> sending_updates [13/Jun/2006:15:03:41 -0700] - _cl5PositionCursorForReplay (agmt="cn=AD" (ad:636)): Consumer RUV: [13/Jun/2006:15:03:41 -0700] NSMMReplicationPlugin - agmt="cn=AD" (ad:636): {replicageneration} 448f18ae000000010000 [13/Jun/2006:15:03:41 -0700] NSMMReplicationPlugin - agmt="cn=AD" (ad:636): {replica 1 ldap://fds:389} 448f18e4000100010000 448f363d03d400010000 448f363d [13/Jun/2006:15:03:41 -0700] - _cl5PositionCursorForReplay (agmt="cn=AD" (ad:636)): Supplier RUV: [13/Jun/2006:15:03:41 -0700] NSMMReplicationPlugin - agmt="cn=AD" (ad:636): {replicageneration} 448f18ae000000010000 [13/Jun/2006:15:03:41 -0700] NSMMReplicationPlugin - agmt="cn=AD" (ad:636): {replica 1 ldap://fds:389} 448f18e4000100010000 448f363d03d700010000 448f363d [13/Jun/2006:15:03:41 -0700] agmt="cn=AD" (ad:636) - session start: anchorcsn=448f363d03d400010000 [13/Jun/2006:15:03:41 -0700] NSMMReplicationPlugin - changelog program - agmt="cn=AD" (ad:636): CSN 448f363d03d400010000 found, position set for replay [13/Jun/2006:15:03:41 -0700] agmt="cn=AD" (ad:636) - load=1 rec=1 csn=448f363d03d600010000 [13/Jun/2006:15:03:41 -0700] NSMMReplicationPlugin - agmt="cn=AD" (ad:636): windows_replay_update: Looking at modify operation local dn="uid=user,ou=people,dc=server,dc=,dc=" (ours,user,not group) [13/Jun/2006:15:03:41 -0700] NSMMReplicationPlugin - agmt="cn=AD" (ad:636): windows_replay_update: Processing modify operation local dn="uid=user,ou=people,dc=server,dc=,dc=" remote dn="<GUID=16f869dcfdde3d42bcb075fd4a1c7980>" I'm not sure what is going on, I can talk via SSL from FDS to AD, and I'm assuming that the PassSync service is working properly since the changes from AD to FDS work. Any suggestions?

5 8

[Fedora-directory-users] data design for inactive users?
by Scott Roberts 14 Jun '06

14 Jun '06

In our ldap we do not delete users, we deactivate them with nsaccountlock. All user entries are in the same branch of the tree. In this data structure, all uid's are unique and are not used again. Ok well now our ldap is getting large and I would like active users separate from inactive users to provide better search performance. AFAIK lot of services keep uid's so they cannot be used again. What's a good design approach? Do inactive users move to another tree? Maybe move to another server and use a referral somehow. What do ldap admins do with all this dead weight? :) __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

4 4

[Fedora-directory-users] Sync problem
by Atr0pos 14 Jun '06

14 Jun '06

Hi list, I'm running FDS on FC4 and have configure windows sync (not password sync for the moment - just groups and accounts) against my AD. All is working well (add - delete) but when I move an AD account from an OU to another one OU (ie. from ou=service,ou=people to ou=people), he is not replicated on FDS (account still on the old OU - ou=service,ou=people). Have you ever seen that ?

1 2

[Fedora-directory-users] Person object unable to update their own attributes
by Paul Clayton 13 Jun '06

13 Jun '06

I have set up a special user with the details Cn=nextuid,ou=Cape Town,dc=mycompany,dc=com The main attribute is "uid". In this is attribute, is a number for example "500" My PHP program uses this person object to determine the next "uid" to use when creating a new user. Problem I am experiencing, is that I am not able to update or modify this person object using the person objects (cn=nextuid) own credentials. I get a "Insufficient 'write' privilege to the 'uid' attribute of entry" (error 50) The ACL allows self write and targets the attribute. Any ideas were I am going wrong. Regards Paul Clayton -------------------------------------------------------- This e-mail and any attachments are confidential and may also be legally privileged and/or copyright material of Intec Telecom Systems PLC (or its affiliated companies). If you are not an intended or authorised recipient of this e-mail or have received it in error, please delete it immediately and notify the sender by e-mail. In such a case, reading, reproducing, printing or further dissemination of this e-mail or its contents is strictly prohibited and may be unlawful. Intec Telecom Systems PLC does not represent or warrant that an attachment hereto is free from computer viruses or other defects. The opinions expressed in this e-mail and any attachments may be those of the author and are not necessarily those of Intec Telecom Systems PLC.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users June 2006